CVE-2024-20481
Cisco ASA and FTD Denial-of-Service Vulnerability
Description
CVE-2024-20481 is a medium-severity denial of service vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software. Rated 5.8 on the CVSS v3.1 scale, the vulnerability allows an unauthenticated, remote attacker to exhaust resources on the RAVPN service by sending a large number of VPN authentication requests, causing a denial of service that disrupts remote access for legitimate users. With an EPSS score of 0.11122 (93.3rd percentile) and inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 14, 2024, this vulnerability poses a significant operational risk for organizations relying on Cisco VPN for remote workforce connectivity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| cisco | secure firewall threat defense | 6.2.3; 6.2.3.1; 6.2.3.2; 6.2.3.3; 6.2.3.4; 6.2.3.5; 6.2.3.6; 6.2.3.7; 6.2.3.8; 6.2.3.9; 6.2.3.10; 6.2.3.11; 6.2.3.12; 6.2.3.13; 6.2.3.14; 6.2.3.15; 6.2.3.16; 6.2.3.17; 6.2.3.18; 6.4.0; 6.4.0.1; 6.4.0.2; 6.4.0.3; 6.4.0.4; 6.4.0.5; 6.4.0.6; 6.4.0.7; 6.4.0.8; 6.4.0.9; 6.4.0.10; 6.4.0.11; 6.4.0.12; 6.4.0.13; 6.4.0.14; 6.4.0.15; 6.4.0.16; 6.4.0.17; 6.4.0.18; 6.6.0; 6.6.0.1; 6.6.1; 6.6.3; 6.6.4; 6.6.5; 6.6.5.1; 6.6.5.2; 6.6.7; 6.6.7.1; 6.6.7.2; 6.7.0; 6.7.0.1; 6.7.0.2; 6.7.0.3; 7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.0.2.1; 7.0.3; 7.0.4; 7.0.5; 7.0.6; 7.0.6.1; 7.0.6.2; 7.1.0; 7.1.0.1; 7.1.0.2; 7.1.0.3; 7.2.0; 7.2.0.1; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.4.1; 7.2.5; 7.2.5.1; 7.2.5.2; 7.2.6; 7.2.7; 7.2.8; 7.2.8.1; 7.3.0; 7.3.1; 7.3.1.1; 7.3.1.2; 7.4.0; 7.4.1; 7.4.1.1 |
| cisco | adaptive security appliance software | 9.8.1; 9.8.1.5; 9.8.1.7; 9.8.2; 9.8.2.8; 9.8.2.14; 9.8.2.15; 9.8.2.17; 9.8.2.20; 9.8.2.24; 9.8.2.26; 9.8.2.28; 9.8.2.33; 9.8.2.35; 9.8.2.38; 9.8.2.45; 9.8.3; 9.8.3.8; 9.8.3.11; 9.8.3.14; 9.8.3.16; 9.8.3.18; 9.8.3.21; 9.8.3.26; 9.8.3.29; 9.8.4; 9.8.4.3; 9.8.4.7; 9.8.4.8; 9.8.4.10; 9.8.4.12; 9.8.4.15; 9.8.4.17; 9.8.4.20; 9.8.4.22; 9.8.4.25; 9.8.4.26; 9.8.4.29; 9.8.4.32; 9.8.4.33; 9.8.4.34; 9.8.4.35; 9.8.4.39; 9.8.4.40; 9.8.4.41; 9.8.4.43; 9.8.4.44; 9.8.4.45; 9.8.4.46; 9.8.4.48; 9.12.1; 9.12.1.2; 9.12.1.3; 9.12.2; 9.12.2.1; 9.12.2.4; 9.12.2.5; 9.12.2.9; 9.12.3; 9.12.3.2; 9.12.3.7; 9.12.3.9; 9.12.3.12; 9.12.4; 9.12.4.2; 9.12.4.4; 9.12.4.7; 9.12.4.8; 9.12.4.10; 9.12.4.13; 9.12.4.18; 9.12.4.24; 9.12.4.26; 9.12.4.29; 9.12.4.30; 9.12.4.35; 9.12.4.37; 9.12.4.38; 9.12.4.39; 9.12.4.40; 9.12.4.41; 9.12.4.47; 9.12.4.48; 9.12.4.50; 9.12.4.52; 9.12.4.54; 9.12.4.55; 9.12.4.56; 9.12.4.58; 9.12.4.62; 9.12.4.65; 9.12.4.67; 9.14.1; 9.14.1.6; 9.14.1.10; 9.14.1.15; 9.14.1.19; 9.14.1.30; 9.14.2; 9.14.2.4; 9.14.2.8; 9.14.2.13; 9.14.2.15; 9.14.3; 9.14.3.1; 9.14.3.9; 9.14.3.11; 9.14.3.13; 9.14.3.15; 9.14.3.18; 9.14.4; 9.14.4.6; 9.14.4.7; 9.14.4.12; 9.14.4.13; 9.14.4.14; 9.14.4.15; 9.14.4.17; 9.14.4.22; 9.14.4.23; 9.14.4.24; 9.15.1; 9.15.1.1; 9.15.1.7; 9.15.1.10; 9.15.1.15; 9.15.1.16; 9.15.1.17; 9.15.1.21; 9.16.1; 9.16.1.28; 9.16.2; 9.16.2.3; 9.16.2.7; 9.16.2.11; 9.16.2.13; 9.16.2.14; 9.16.3; 9.16.3.3; 9.16.3.14; 9.16.3.15; 9.16.3.19; 9.16.3.23; 9.16.4; 9.16.4.9; 9.16.4.14; 9.16.4.18; 9.16.4.19; 9.16.4.27; 9.16.4.38; 9.16.4.39; 9.16.4.42; 9.16.4.48; 9.16.4.55; 9.16.4.57; 9.16.4.61; 9.17.1; 9.17.1.7; 9.17.1.9; 9.17.1.10; 9.17.1.11; 9.17.1.13; 9.17.1.15; 9.17.1.20; 9.17.1.30; 9.17.1.33; 9.17.1.39; 9.18.1; 9.18.1.3; 9.18.2; 9.18.2.5; 9.18.2.7; 9.18.2.8; 9.18.3; 9.18.3.39; 9.18.3.46; 9.18.3.53; 9.18.3.55; 9.18.3.56; 9.18.4; 9.18.4.5; 9.18.4.8; 9.18.4.22; 9.18.4.24; 9.19.1; 9.19.1.5; 9.19.1.9; 9.19.1.12; 9.19.1.18; 9.19.1.22; 9.19.1.24; 9.19.1.27; 9.19.1.28; 9.19.1.31; 9.20.1; 9.20.1.5; 9.20.2; 9.20.2.10; 9.20.2.21 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
References
Weakness Type
The specific CWE classifications for CVE-2024-20481 have not been formally assigned. The vulnerability is functionally a resource exhaustion weakness in the RAVPN service. The VPN authentication handler does not implement adequate rate limiting or resource management for incoming authentication requests, allowing an attacker to overwhelm the service by flooding it with connection attempts. This class of vulnerability is particularly impactful on VPN concentrators because the authentication processing path typically involves computationally expensive operations such as cryptographic handshakes, certificate validation, and backend AAA (Authentication, Authorization, and Accounting) server queries, all of which consume significant CPU, memory, and connection table resources.
Impact Analysis
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) reflects a network-accessible, low-complexity attack with no privileges or user interaction required. The Scope Changed designation indicates the denial of service extends beyond the RAVPN service itself, potentially affecting other services on the ASA/FTD appliance. While the Availability impact is rated Low per CVSS, the real-world business impact can be severe for organizations dependent on VPN access. A denial of service against the RAVPN service disconnects all remote workers, disrupts site-to-site VPN tunnels, and prevents emergency access to internal resources. Business consequences include workforce productivity loss, inability to respond to security incidents remotely, potential revenue loss for organizations with remote-dependent operations, and cascading failures in systems that depend on VPN connectivity. The EPSS score of 0.11122 (93.3rd percentile) indicates significant exploitation probability, and the attack has been observed as part of large-scale password spraying and brute-force campaigns against VPN endpoints. The extremely broad range of affected ASA (9.8.x through 9.20.x) and FTD (6.2.x through 7.4.x) versions means virtually every deployed Cisco VPN appliance is potentially vulnerable.
Exploit Maturity
CVE-2024-20481 is confirmed as actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 14, 2024. The ransomware association is classified as "Unknown." The EPSS score of 0.11122 (93.3rd percentile) reflects notable exploitation probability. Cisco has published a detailed security advisory documenting the vulnerability and available fixes. The exploitation method aligns with widely observed brute-force and credential-stuffing campaigns targeting VPN endpoints, where the side effect of the attack volume triggers the denial of service condition. This means organizations may experience the DoS even when the attacker's primary goal is credential compromise rather than service disruption. The low barrier to exploitation — requiring only a flood of HTTP/HTTPS requests to the VPN login endpoint — makes this vulnerability exploitable by any attacker with basic scripting capabilities.
Remediation
- Apply Cisco software updates — Install the patched versions of ASA or FTD software as specified in the Cisco security advisory. Given the large number of affected versions, carefully identify your current version and the appropriate upgrade path.
- Implement rate limiting on VPN authentication — Configure connection rate limits and authentication throttling on the ASA/FTD to prevent a flood of authentication requests from consuming all available resources. Use threat detection features to identify and block sources of excessive connection attempts.
- Deploy DDoS protection for VPN endpoints — Place VPN endpoints behind a DDoS mitigation service or cloud-based access proxy that can absorb volumetric authentication floods before they reach the ASA/FTD appliance.
- Enable threat detection and shunning — Configure ASA threat detection features to automatically identify and block IP addresses that exceed authentication attempt thresholds. Use the "threat-detection service" and "shun" capabilities to drop traffic from offending sources.
- Monitor VPN authentication metrics — Establish baseline authentication volumes and configure alerting for abnormal spikes in VPN authentication requests. This enables rapid detection and response to ongoing brute-force campaigns before they escalate to denial of service conditions.
Technical Details
The CVSS v3.1 vector for CVE-2024-20481 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, resulting in a base score of 5.8 (Medium). Attack Vector (Network) confirms remote exploitation against the VPN endpoint. Attack Complexity (Low) means the attack requires only a high volume of standard authentication requests. Privileges Required (None) and User Interaction (None) confirm the attack is fully unauthenticated and automated. Scope (Changed) indicates the impact extends beyond the RAVPN service to potentially affect other services on the appliance, such as management access, other VPN types, or firewall throughput. Confidentiality (None) and Integrity (None) confirm no data exposure or modification. Availability (Low) is rated conservatively, though the real-world impact of a VPN service outage is often much higher than the metric suggests. The attack mechanism exploits a resource exhaustion condition in the RAVPN service's authentication processing pipeline. When an attacker sends a large volume of VPN authentication requests — typically HTTPS-based SSL VPN login attempts — the service allocates resources for each connection attempt including memory, CPU cycles for TLS negotiation, and backend AAA query slots. Without adequate rate limiting, the cumulative resource consumption exceeds the appliance's capacity, causing the RAVPN service to become unresponsive to both the attack traffic and legitimate user connections.
Frequently Asked Questions
What is CVE-2024-20481?
CVE-2024-20481 is a denial of service vulnerability in the Remote Access VPN (RAVPN) service of Cisco ASA and Firepower Threat Defense software. An unauthenticated attacker can send a large volume of VPN authentication requests to exhaust resources and make the VPN service unavailable to legitimate users.
How does CVE-2024-20481 affect my organization?
If your organization uses Cisco ASA or FTD for remote access VPN, this vulnerability can disrupt remote workforce connectivity. The attack can be triggered as a side effect of brute-force credential attacks, meaning you may experience the denial of service even when the attacker's primary goal is password guessing.
Which Cisco products are affected by CVE-2024-20481?
Virtually all recent versions of Cisco ASA Software (9.8.x through 9.20.x) and Cisco FTD Software (6.2.x through 7.4.x) with the RAVPN service enabled are affected. This covers the vast majority of deployed Cisco VPN appliances.
How do I mitigate CVE-2024-20481?
Apply the software updates from Cisco's security advisory. As immediate mitigations, implement authentication rate limiting, enable threat detection features to automatically block abusive IP addresses, and consider placing VPN endpoints behind DDoS mitigation services.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.